← All programs
PublicLogisticsManaged triageSafe harborcoordinated disclosure
Parcelo
Last-mile logistics marketplace in 14 countries.
Unfundedlaunched 30 Jun 2023
pgn scope pull parcelo
Submit report Response, measured
last 90 daysMedian triage
31h
commitment 72h
Median to bounty
16d
commitment 32d
Queue right now
29
188 received · 52 resolved
Response score
82%
within commitment
Triage: median vs commitment31h / 72h
Bounty: median vs commitment16d / 32d
Escrow
Not escrowed
Payouts depend on the program's own cash each cycle. Other platforms do not show this. We do, and it costs the program ranking until it funds.
Paid all-time
$780k
Hunters thanked
240
Bounty table
- critical$8,000 – $25k
- high$2,500 – $8,000
- medium$600 – $2,500
- low$150 – $600
Bands are floors and ceilings the program is held to. Mediation can move a report within a band, never below the floor of its agreed severity.
Scope · 3 assets
signed · diff feed available| Asset | Type | Max severity | Eligible | Note |
|---|---|---|---|---|
| parcelo.example | web | critical | yes | Shipper web |
| api.parcelo.example | api | critical | yes | Shipper and courier APIs |
| com.parcelo.courier | mobile | high | yes | Courier app |
Out of scope
- Price manipulation that is corrected at checkout
- Tracking-number enumeration without PII exposure
Policy
Standard CVSS 3.1 with business-impact review on marketplace logic.
#marketplace#idor#payments
Recent reports · 3
Filter hacktivity →- highPGN-10444
HTTP/2 to HTTP/1.1 downgrade desync on courier API edge allows request queue poisoning
A CRLF in an H2 header value survived translation at the edge. Impact was framed as capture of the next researcher-owned request on the same connection.
$7,000Resolved - mediumPGN-10405
Shipper API exposes courier phone numbers via nested include parameter
A single sample and the range arithmetic for the id space were provided; no bulk retrieval was performed.
$1,800Resolved - highPGN-10336
Courier app accepts server-signed delivery proof for a different parcel id
The signature covered the courier id and timestamp but not the parcel id.
$6,000Resolved